023d38d5630b66dbf66c1f23be937f66a4d55b2aab0473ad7a6eb84557e3d63a

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 00:43

Target

Unlimited Menus/Data/Command Line Help.lnk
Size

1KB
MD5

317e650b0f37645d8306b94c0b70b0a3
SHA1

210aac769cdb661743fb80e0593aee37be722d85
SHA256

03300cee244bc456241ae3031c4ae49f883de569cb2e4949cc68a81776212d69
SHA512

93c7df208ed9b908d1366866fcabaaf26a265ba42e6dc5634a475a6789af05abfab155db907eacf8ddaeb34e7f6ed3100357ee62e9ac4ab33c0292d9cbe45cf7

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2724	1892	cmd.exe	31
PID 1892 wrote to memory of 2724	1892	cmd.exe	31
PID 1892 wrote to memory of 2724	1892	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Unlimited Menus\Data\Command Line Help.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:1892
- C:\WINDOWS\hh.exe
  "C:\WINDOWS\hh.exe" ms-its:C:\WINDOWS\Help\ntcmds.chm::/ntcmds.htm
  2⤵
  PID:2724

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact